where \(\mathbb {S} \left(\mathbf {x}_i, \delta _{\text{off }}\right)\)  denotes an \(\ell _{\infty }\)  sphere centered at \(\mathbf {x}_i\)  with a radius \(\delta _{\text{off }}\) .
The \(\delta _{\text{off }}\)  is relatively large to ensure that the sphere \(\delta _{\text{off }}\)  lies outside of the data manifold [1]}, [2]}.
Then we can get pseudo off-manifold samples from \(\delta _{\text{off }}\)  along the adversarial direction, which is calculated from the gradient of the classification loss.
